Parse bug with extra non-nullable br_on_cast values

[tlively]

(module
  (type $s (struct))
  (func (param $s (ref $s)) (result (ref $s) (ref $s))
    local.get $s
    local.get $s
    br_on_cast 0 (ref $s) (ref $s)
  )
)

[wasm-validator error in function 0] unexpected false: non-nullable local's sets must dominate gets

Looks like we're not setting up the scratch locals quite right. It doesn't look like we're properly preserving exact results, either.